[021/119] highmem: Fix race in debug_kmap_atomic() which could cause warn_count to underflow

Greg KH
2009-12-07T00:34:32Z

[-- Attachment #1: highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch --]
[-- Type: text/plain, Size: 1211 bytes --]

2.6.31-stable review patch. If anyone has any objections, please let us know.

------------------
From: Soeren Sandmann <sandmann@daimi.au.dk>

commit 5ebd4c22897dce65845807a9bd3a31cc4e142b53 upstream.

debug_kmap_atomic() tries to prevent ever printing more than 10
warnings, but it does so by testing whether an unsigned integer
is equal to 0. However, if the warning is caused by a nested
IRQ, then this counter may underflow and the stream of warnings
will never end.

Fix that by using a signed integer instead.

Signed-off-by: Soeren Sandmann Pedersen <sandmann@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: a.p.zijlstra@chello.nl
LKML-Reference: <ye8zl7b8ktj.fsf@camel23.daimi.au.dk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
mm/highmem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -426,9 +426,9 @@ void __init page_address_init(void)

void debug_kmap_atomic(enum km_type type)
{
- static unsigned warn_count = 10;
+ static int warn_count = 10;

- if (unlikely(warn_count == 0))
+ if (unlikely(warn_count < 0))
return;

if (unlikely(in_interrupt())) {